Executive brief
NSAuditor RemShutdown, a tool used for remote computer management and shutdown tasks, is vulnerable to a flaw that can cause the application to crash. An attacker can trigger this by entering an excessively long registration key into the software's activation field. This results in a denial-of-service, preventing legitimate users from using the application until it is restarted.
Technical details
A classic buffer overflow (CWE-120) exists in NSAuditor RemShutdown version 2.9.0.0. The vulnerability is located in the registration key input component, which fails to properly validate the length of the input buffer before copying it. An attacker can exploit this by pasting a 1000-character string into the 'Key' field under the 'Register' menu. This action triggers an application crash (Denial of Service). While the attack requires local access and user interaction to paste the payload, it demonstrates a lack of bounds checking on user-supplied strings. No official patch is currently noted in the advisory.
Affected products
- NSAuditor RemShutdown 2.9.0.0
Timeline
- 2020-01-06: disclosed: Initial exploit PoC published on Exploit-DB
- 2026-02-11: advisory: CVE published and added to NVD